vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add automatic HTTPS with ACME

642e599466fe4f5066afdc9a24775694a52c9749 · Keenan Nemetz · 14d ago · parent 91e6a33a

docs/operations.md +9−5

@@ -6,11 +6,12 @@ These are the tasks that keep an instance healthy.
	6	6
	7	7	## Back up an instance
	8	8
	9		Back up three things:
		9	Back up the instance state:
	10	10
	11	11	```sh
	12	12	vole admin user backup backup/users.db # accounts, keys, passkeys, sessions, rules, locks
	13		cp data/ssh_host_ed25519_key backup/ # the only secret on the machine
		13	cp data/ssh_host_ed25519_key backup/ # the SSH host key
		14	cp -a data/acme backup/ 2>/dev/null # TLS account key and certificates, if ACME is on
	14	15	cp data/audit.log backup/ 2>/dev/null # history of admin actions
	15	16	```
	16	17
@@ -29,7 +30,8 @@ with them because they are stored in Git.
	29	30
	30	31	## Restore an instance
	31	32
	32		1. Restore `data/users.db`, `data/ssh_host_ed25519_key`, and `data/audit.log`.
		33	1. Restore `data/users.db`, `data/ssh_host_ed25519_key`, `data/audit.log`, and
		34	`data/acme/` if the instance obtains its own TLS certificates.
	33	35	2. Restore the repositories under `data/repos/`.
	34	36	3. Run `vole admin index rebuild`.
	35	37	4. Run `vole admin user revoke-sessions --all` so sessions from the restored copy
@@ -104,5 +106,7 @@ repository's `vole` branch.
	104	106	admins can run it, and every admin command is audited.
	105	107	- Private repositories return `404` on the web and over HTTP, so visitors cannot
	106	108	confirm that they exist.
	107		- Vole does not handle TLS. Put it behind a proxy that terminates TLS and keeps
	108		the `Host` header, so site routing still works.
		109	- Vole can obtain and renew TLS certificates itself when `https_addr` is set;
		110	otherwise put it behind a proxy that terminates TLS and keeps the `Host`
		111	header, so site routing still works. See
		112	[Configuration § Automatic HTTPS with ACME](configuration.md#automatic-https-with-acme).